JamaicaData Protection Act, 2020, the Information Commissioner, penalties and compensation
Data Protection Act, 2020 (Act 7 of 2020), ss. 4, 44, 46-55, 61, 62, 67-69
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Information Commissioner to serve an enforcement notice requiring you to take specified steps, or to refrain from processing personal data, where the Commissioner is satisfied you have contravened a data protection standard.
- Comply with an enforcement notice, an assessment notice or an information notice from the Information Commissioner, and do not make a statement in purported compliance with one that you know, or recklessly disregard, to be false in a material respect.
- Do not knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, and do not sell or offer to sell personal data obtained that way.
- Compensate an individual who suffers damage by reason of your contravention of any requirement of the Act, and compensate distress where that individual also suffers damage or the contravention relates to processing for the special purposes.
- Expect a fine of up to four percent of your annual gross worldwide turnover for the preceding year of assessment where your company is convicted of an offence under the Act.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Knowingly or recklessly obtaining, disclosing or procuring the disclosure of personal data without the data controller's consent, and selling or offering to sell personal data so obtained, are offences under section 61, liable on summary conviction in a Parish Court to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years, and on conviction on indictment in a Circuit Court to a fine or imprisonment not exceeding ten years (s. 61(10)). Failing to comply with an enforcement notice, an assessment notice or an information notice, or making a knowingly or recklessly false statement in purported compliance with one, is an offence under section 52(1) and (2), liable on conviction in a Parish Court to a fine not exceeding JMD 1,000,000 (s. 52(4)). Where the offender is a body corporate, section 68(1) applies notwithstanding any other penalty specified in the Act and sets the fine at up to four percent of its annual gross worldwide turnover for the preceding year of assessment.
Penalty structure
Section 68(1) applies notwithstanding any other penalty specified in the Act and caps a body corporate's fine for any offence under the Act at four percent of its annual gross worldwide turnover for the preceding year of assessment, with section 68(2) directing the court to weigh the estimated economic cost to consumers and users, the economic benefit the body corporate derived, how long the contravention continued and the number and severity of its other offences under the Act. The fixed sums the Act states for particular offences bind a natural person: JMD 5,000,000 or five years on summary conviction under sections 61(10) and 19(5), JMD 2,000,000 or two years under section 21(2), JMD 2,000,000 or six months under section 18(3), and JMD 1,000,000 under section 52(4), with an unspecified fine available on conviction on indictment. The Commissioner has no power to impose an administrative fine, only to offer a fixed penalty in the prescribed amount under section 62 for the offences that section names.
- Rule
- Turnover pct only
- As of
- 19 September 2026
- Currency
- JMD
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Office of the Information Commissioner
What it reaches
Obligation class
Prohibition, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 4 establishes for the purposes of the Act an office to be known as the Information Commissioner, a body corporate that performs the functions the Act confers on it.
Where the Commissioner is satisfied that a data controller has contravened, or is contravening, any of the data protection standards, the Commissioner may serve an enforcement notice requiring specified steps within a specified time or requiring the controller to refrain from processing, and may also serve assessment notices and information notices and exercise the powers of entry and inspection in the Third Schedule.
An individual who is, or believes themselves to be, directly affected by processing may ask the Commissioner to assess whether it is carried out in compliance with the Act. Failing to comply with an enforcement notice, an assessment notice or an information notice, or making a knowingly or recklessly false statement in purported compliance with one, is an offence under section 52 carrying a fine of up to JMD 1,000,000 on conviction in a Parish Court.
Section 61 makes it an offence to knowingly or recklessly obtain, disclose or procure the disclosure of personal data without the consent of the data controller concerned, or to sell or offer to sell personal data so obtained, liable on summary conviction to a fine not exceeding JMD 5,000,000 or imprisonment not exceeding five years and on conviction on indictment to a fine or imprisonment not exceeding ten years.
Section 68(1) provides that notwithstanding any other penalty specified in the Act, a body corporate that commits an offence under the Act is liable to a fine not exceeding four percent of its annual gross worldwide turnover for the preceding year of assessment.
Section 69 entitles an individual who suffers damage by reason of a data controller's contravention of any requirement of the Act to compensation from that data controller, and to compensation for distress where the individual also suffers damage or the contravention relates to processing for the special purposes.
Proceedings for an offence under the Act may be instituted only by the Director of Public Prosecutions, or by the Commissioner with the Director's consent, and a person aggrieved by a decision of the Commissioner other than one of those notices may appeal to the Appeal Tribunal.
The Act is in force: it reached its appointed day under the Appointed Day Notice gazetted in 2023, the mechanism its own commencement clause leaves to a notice published in the Gazette, and no notice stating the day itself has been located.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
Text of the Data Protection Act, 2020 as published by the Houses of Parliament of Jamaica
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.